TLS ClientHello (JA4)

t13d1912h2_9dc949149365_e5728521abd4

first seen 2026-06-29 09:47 · last seen 2026-07-22 19:03 · JSON

Decomposed attributes

Protocolt (TLS over TCP)
TLS version13
SNId (domain)
Cipher count19
Extension count12
ALPNh2
Ciphers000a, 002f, 0035, 009c, 009d, 1301, 1302, 1303, c009, c00a, c012, c013, c014, c02b, c02c, c02f, c030, cca8, cca9
Extensions0005, 000a, 000b, 000d, 0012, 0017, 002b, 0032, 0033, ff01
Signature algorithms0804, 0403, 0807, 0805, 0806, 0401, 0501, 0601, 0503, 0603, 0201, 0203
JA4_rt13d1912h2_000a,002f,0035,009c,009d,1301,1302,1303,c009,c00a,c012,c013,c014,c02b,c02c,c02f,c030,cca8,cca9_0005,000a,000b,000d,0012,0017,002b,0032,0033,ff01_0804,0403,0807,0805,0806,0401,0501,0601,0503,0603,0201,0203
JA4_o (sample)t13d1912h2_b565e0f3de94_c9c082b8df90
JA4_ro (sample)t13d1912h2_c02b,c02f,c02c,c030,cca9,cca8,c009,c013,c00a,c014,009c,009d,002f,0035,c012,000a,1301,1302,1303_0000,000b,ff01,0017,0012,0005,000a,000d,0032,0010,002b,0033_0804,0403,0807,0805,0806,0401,0501,0601,0503,0603,0201,0203

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

HTTP request (JA4H)

fingerprintco-occurrences
ge20nr020000_5594a17e7e7e_000000000000_0000000000003
ge20nn030000_ff50983941c1_000000000000_0000000000002
ge20nr030000_ff50983941c1_000000000000_0000000000002
ge20nr030000_80b089f68b8e_000000000000_0000000000002
ge20nr020000_e5a56608905c_000000000000_0000000000002
ge20nn030000_80b089f68b8e_000000000000_0000000000001
ge20nr050000_a65a228298b1_000000000000_0000000000001
ge20nr050000_ed3826eaa3a5_000000000000_0000000000001

HTTP/2 frames (Akamai)

fingerprintco-occurrences
2:0;4:4194304;5:16384;6:10485760|1073741824|0|a,m,p,s Match?Exact match in Thumbprint's published controlled catalog captures: go-net/http 1.26.6, go-net/http 1.26.8, go-net/http 1.26.7, +6 more.The fingerprint page shows the full measured match list. More on the catalog.14

TCP SYN (p0f)

fingerprintco-occurrences
4:54+10:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:07
4:49+15:0:1460:mss*29,9:mss,sok,ts,nop,ws:df,id+:05
4:56+8:0:1460:mss*29,11:mss,sok,ts,nop,ws:df,id+:02

TCP SYN (JA4T)

fingerprintco-occurrences
64240_2-4-8-1-3_1460_77
42340_2-4-8-1-3_1460_112

User-Agent

fingerprintco-occurrences
Mozilla/5.0 (compatible; pathscan/1.0)7
Mozilla/5.0 NextScanner/4.07

Country

fingerprintco-occurrences
RO · Romania7
ID · Indonesia5
NL · Netherlands2

Network (ASN)

fingerprintco-occurrences
AS204428 · SS-Net7
AS150436 · Byteplus Pte. Ltd.5
AS48090 · TECHOFF SRV LIMITED2